All vulnerabilities
CVE-2026-98787

Linux: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in94f41ec5fa578765b74ad5736c2f029e7aabc46dFixed versionCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 94f41ec5fa578765b74ad5736c2f029e7aabc46dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration to be disabled. All callers of rhtab_delete_elem() disable migration except __rhtab_map_lookup_and_delete_batch(), which calls it under rcu_read_lock() only.

On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or migration, so the task can migrate between CPUs during the delete loop, causing this_cpu_ptr() to trigger:

BUG: using smp_processor_id() in preemptible [00000000] code

Fix by wrapping the delete loop in migrate_disable()/migrate_enable() in __rhtab_map_lookup_and_delete_batch(), matching the migration protection that the other callers already provide.

Text from CVE List

Affected versions 6

  • Linuxaffected: 818e0084822742fc00eacbf5df3476a5e72c7d0e before 94f41ec5fa578765b74ad5736c2f029e7aabc46dCVE List
  • Linuxaffected: 818e0084822742fc00eacbf5df3476a5e72c7d0e before de020dc8049bfb2b22e3b6d99c031feb2e22d112CVE List
  • Linuxaffected: 7.2CVE List
  • Linuxunaffected: all versions before 7.2CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2